Index
> Windows > RegDeleteTree at WinXP x64 |
| Author |
|
|
bitRAKE 07 Aug 2013, 17:35
On first look you are not passing address in RegOpenKeyEx - last parameter should be "ADDR o". I've not tested the code though.
_________________ ¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup |
|||
07 Aug 2013, 17:35 |
|
|
semiono 07 Aug 2013, 18:32
I need delete like this:
HKEY_LOCAL_MACHINE\Software\a\New Key #1\New Key #1 HKEY_LOCAL_MACHINE\Software\a\New Key #1\New Key #2 HKEY_LOCAL_MACHINE\Software\a\New Key #2\New Key #1\New Key #1\New Key #1 |
|||
|
07 Aug 2013, 18:32 |
|
|
bitRAKE 07 Aug 2013, 18:55
Did you try RegDeleteTree?
Oh, looks like WinXP doesn't have that function. On my machine it works to delete all keys under \a\*, but it does not delete the values under \a\*. Could enumerate HKEY_LOCAL_MACHINE\Software until "a" is found and then delete that key? Code: invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,'Software',NULL,KEY_WOW64_64KEY+KEY_ENUMERATE_SUB_KEYS,o @@: invoke RegEnumKey,[o],NULL,a,MAX_PATH cmp eax,NULL jne @f cmp word [a],'a' jne @B invoke RegDeleteKeyEx,[o],a,KEY_WOW64_64KEY,NULL @@: invoke RegCloseKey,[o] (Don't have WinXP64 here to test.) _________________ ¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup |
|||
|
07 Aug 2013, 18:55 |
|
|
semiono 07 Aug 2013, 19:42
Thanks!
Quote: The subkey to be deleted must not have subkeys. msdn.microsoft.com/en-us/library/windows/desktop/ms724847(v=vs.85).aspx |
|||
|
07 Aug 2013, 19:42 |
|
|
bitRAKE 07 Aug 2013, 20:51
How does this work?
See Below.  _________________ ¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup Last edited by bitRAKE on 08 Aug 2013, 03:42; edited 1 time in total |
|||
|
07 Aug 2013, 20:51 |
|
|
semiono 08 Aug 2013, 01:44
Thank You!
!!!
This work! But if the key doesn't exist this tool hung up with loop  |
|||
|
08 Aug 2013, 01:44 |
|
|
bitRAKE 08 Aug 2013, 03:41
Yeah, I forgot about the index:
Code: include 'win32ax.inc' section '.code' executable start: invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,_,NULL,KEY_WOW64_64KEY+KEY_ENUMERATE_SUB_KEYS,o lea edi,[a] mov al,'\' stosb xor esi,esi @@: invoke RegEnumKey,[o],esi,edi,MAX_PATH inc esi cmp eax,NULL jne @f ; find root, string compare cmp word [edi],'a' jne @B call Recurse invoke RegDeleteKeyEx,[o],edi,KEY_WOW64_64KEY,NULL @@: invoke RegCloseKey,[o] exit: invoke ExitProcess,NULL Recurse: push edi esi [o] ;mov al,0 or ecx,-1 repnz scasb invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,_,NULL,KEY_WOW64_64KEY+KEY_ENUMERATE_SUB_KEYS,o mov byte[edi-1],'\' xor esi,esi @@: invoke RegEnumKey,[o],esi,edi,MAX_PATH inc esi test eax,eax jnz @f call Recurse invoke RegDeleteKeyEx,[o],edi,KEY_WOW64_64KEY,NULL jmp @B @@: invoke RegCloseKey,[o] mov byte[edi-1],0 pop [o] esi edi retn KEY_WOW64_64KEY = 0x0100 section '.data' readable writeable _ db 'Software' a rb MAX_PATH o dd NULL section '.idata' import readable library advapi32,'ADVAPI32.DLL',kernel32,'KERNEL32.DLL',user32,'USER32.DLL' import advapi32,RegCloseKey,'RegCloseKey',RegEnumKey,'RegEnumKeyA',RegOpenKeyEx,'RegOpenKeyExA',RegDeleteKeyEx,'RegDeleteKeyExA' import kernel32,ExitProcess,'ExitProcess' import user32,MessageBox,'MessageBoxA'
(It can be optimized, but I'll leave that to the future.) _________________ ¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup |
|||
|
08 Aug 2013, 03:41 |
|
< Last Thread | Next Thread > |
Forum Rules:
|